CVE-2026-58049: ffmpeg Out-of-bounds Write

Vulnerability summary

CVE-2026-58049 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in ffmpeg. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-06-2026
   PublishedVulnerability first disclosed.
2. 01-09-2026
   Last modifiedVulnerability information updated.

Description

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.